Hi and welcome back to another episode on How to Hack.
So over here, I have mutability running and mutability is a vulnerable Web application server for us
to learn about Web application penetration testing.
So on the left side, you can see, oh, WSP Top 10, Open Web Application Security Project, top 10
vulnerabilities.
So these are vulnerabilities that could be inherent in Web application servers that are commonly found
vulnerabilities.
So over here, we can look at injection, SQL injection, XHTML injection.
We can look at broken authentication, recession management.
So we'll be covering a lot of all these Web application vulnerabilities over the next few tutorials
to learn more about how penetration testing is being conducted against all these different Web application
service.
So another thing I want to highlight to you is about the use of a tool.
And this tool is what we call Zet proxy.
So all I got to do is enter ZET Proxy and we can kick start this open web application security project
zap.
So it'll allow us the ability to scan the sites, automatically define vulnerabilities.
So it is a automated scanner and at the same time it will also show us the kind of payloads that are
being injected into the site so that we can also learn and educate ourselves about how all this has
come about.
And of course, we can also think about customizing the payloads, changing the variables of the payload
in our attacks.
So in this case, we can not proceed at this moment in time.
QuickStart and we have this particular QuickStart page called Automated Scan.
So this help us run the automated attack.
But I want to highlight a little more about the graphical user interface of a subset.
So over here, we have on top side, we have all this taps, so we have to sashayed management.
So this session depends on the number of sessions and scanning.
You're running for different websites and we have the added moat we have to view.
All right.
And we have the analyzer to scan policy manager so we can go in and click on that so we can actually
look at the modification of the scan policy.
And all the scan policies can also be managed as part of running a website.
And a great thing is that help us generate reports like HTML, XML Report, Mokhtari Port and so on.
So this makes it particularly useful if you have to report to management, if you have to report the
findings to different people, different stakeholders.
And we have all these different tools as well.
And all those tools can be highly useful in helping us run different kind of policy checks so we can
click on our options.
So we have the scanning options and we have all these different rules searching and most importantly
is to actually look at to local proxies.
So on don't look at proxies.
We have local hosts and we have to put number eight 080.
So this is really helpful for us to point our target system of choice.
And of course, also, depending on a browser, we can also select specifically to kind of browser we
want to target against the system.
So moving forward, we can actually go ahead and run it all the way to scan.
So all we can do is specify the URL and we can actually launch the attack from here.
So in my case, I can enter one or two one six eight zero dot two on two, which is the Web application
server running multiple today.
So I can just push me until the day and all I got to do is run an attack and then again begin launching
an initializing the attack against the system.
So all we can do is go back here.
So we got one or two, one six eight zero two one to slash my utility slash and we can go in and click
on attack.
So immediately the automated attack would take a while.
So we are spidering across the entire site finding all the links and pages so we can go after.
So once we complete a spidering OK, what we can do next is to run the active scan.
Again, it is page to see whether there are any vulnerabilities.
And a great thing is that for a site like mutability, it could take up to five 10 minutes for a scan
to complete.
And while the scan is happening, we can actually click under alerts.
So when I click on alerts, we can actually see the different kind of payloads attack as well as findings.
So, for example, over here we have path to vessel and we can actually double click on it and expand
further and look at a Psystar being affected or being impacted by this attack.
So, for example, over here we have all this different payload, Sture being sent into the site so
I can double click on it and I can actually look at a new URL and I can copy the URL.
I can go back into the browser and open up a browser.
And I can open up a tab and I can hit enter on this and look at our findings directly from here so we
can look at the findings and of course, immediately we are able to extract this particular fall.
So this poll is ETSI plus W.T. So this would actually lucedale all the user accounts inside the server.
So immediately we can find Root, we can find Dayman, we can find Bin, we can find all these different
accounts that are actually in site, the Linux system.
So this is in a way, an operating system command.
It allows us to see all this different information, true.
Deep after vessel, and we can also change it.
All right.
So instead of possibly, can we change it to something else?
So this is the part where we are looking at trying to find out all these different data.
So, of course, can we find Etsi Shadow?
Are we able to find those data sources?
Permission denied.
OK, so again, we are trying to find all this different data directly from the system to help us find
out more details, more information.
Can we try to find a home?
All right.
So again, we are trying to find all this different information, which is why the use of Linux commands
are very, very important, because if we understand how Linux commands work, we will have the ability
to try to find more information about a site while the observer is actually doing all this, finding
all these different attacks directly against the system.
OK, so let's go back into the findings.
So here we have puft vessel.
We have removed file inclusion.
OK, so again, this means that the site actually a lot of sites to be included into these pages, which
is means that the hackers could actually try to do a defacement and they could actually insert your
own pages into the site.
So over here, for example, we have payload and we have these particular you URL.
Again, I can copy this information and I can actually paste it again into the Eurail of your browser
and hit enter on debt.
And immediately we see a Google search information from here.
So we were able to abate something into this site immediately.
And of course, what the hackers would do is that they would give a legitimate link.
Right.
That represents this particular site and it is being sent over into the victim's computer as a URL.
So, for example, I can change Google dot com if we can change it to my site, Loy Yang dot com and
see whether it floats.
So this is, again, a way for us to test using different kind of variables to see whether we are able
to access to different sites.
OK, so again, we are trying to test out all this different systems.
Can we try Gmail dot com, for example?
But we do get the same result, but we do get different information.
So likewise, the same thing is being shown over here.
So the hackers are able to meet this kind of pages, this kind of different sites into the link and
be able to change up the variables, especially from the different payload stuff being sent directly
from all upset that will actually allow the hackers to change up a little more, a man a little more
about how they want to launch all these different attacks.
So, like, likewise, we can see SQL injection, we can see cross site scripting, OK, so we are able
to see all this different data and we can go back into the active scan result.
So we are at fifty one percent done.
So we can understand directly from here what are the pages that are actually subjected to different
kind of SQL injection, do cross scripting and we can try to launch our attack from there.
So the great thing of course is that when we go back into this site, we can actually reset the database,
especially when you put in so much different kind of payloads into the site that could actually corrupt
the database.
So a lot of times when we are doing all these different attacks, we want to make sure that we can ascertain
how the site is performing.
And of course, when you're doing an actual penetration testing, a lot of times you'll be targeting
these environments that are actually making the production service.
So that is also another point that you want to highlight when you're doing your Web application penetration
testing.
All right.
So with that, let me know, what are the findings that you can get from your all upset against a target
systems?
And if you like what you've just watch remotely like and subscribe to channel so that you can be kept
abreast of the latest cyber security target.
Thank you so much once again for watching.